CVE-2026-16301 in GitLab
Summary
by MITRE • 10/13/2026
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
GitLab has addressed a critical security vulnerability impacting its Community Edition and Enterprise Edition across multiple release lines, specifically versions prior to 19.2.8 for the 18.7 branch, before 19.3.5 for the 19.3 branch, and before 19.4.2 for the 19.4 branch. This flaw represents a significant breach in access control mechanisms within the platform's CI/CD pipeline execution logic. The vulnerability stems from improper authorization checks embedded within the downstream pipeline creation service, which is responsible for initiating new pipelines based on triggers such as merge requests or manual actions. Under specific conditions related to how protected branches are handled and how permissions are validated during this process, an attacker with a relatively low-privilege Developer role was able to bypass security controls designed to restrict write access to critical code paths.
The technical core of the issue lies in the failure of the authorization middleware to correctly verify whether the authenticated user possessed sufficient privileges to trigger pipeline execution on protected branches. Protected branches are typically configured to prevent direct pushes and often require specific approval workflows or higher-level permissions for any modifications, including triggering automated processes that could affect deployment states or security scanning results. By exploiting this gap in logic, an attacker with Developer access, which is generally intended for feature development rather than production-impacting changes, was able to execute CI/CD pipelines on these protected branches without the required authorization. This bypass allows the execution of arbitrary code within the GitLab Runner environment under the context of the pipeline configuration defined by the repository maintainers or administrators.
The operational impact of this vulnerability is severe due to the nature of Continuous Integration and Continuous Deployment systems. When a CI/CD pipeline executes, it typically runs scripts that build software artifacts, run tests, and potentially deploy code to staging or production environments. An unauthorized execution on a protected branch means an attacker could manipulate these processes to exfiltrate sensitive data stored in environment variables, inject malicious code into the build process for supply chain compromise, or disrupt service availability by triggering resource-intensive jobs. Furthermore, because protected branches often represent stable release lines, compromising their pipeline integrity can lead to the deployment of compromised artifacts if downstream stages are not adequately isolated or verified. This effectively undermines the trust model that relies on branch protection rules to maintain code quality and security standards in collaborative development environments.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Control, as it involves an actor obtaining privileges they were not explicitly granted through flawed authorization logic. It also maps to MITRE ATT&CK techniques related to Initial Access via valid accounts and potentially Execution if the pipeline scripts are manipulated or if the attacker leverages the runner environment for further lateral movement within the CI/CD infrastructure. The flaw highlights a common challenge in complex web applications where service boundaries, such as those between user-facing interfaces and backend processing services like downstream pipeline creation, may not consistently enforce security policies across all code paths.
To mitigate this risk, organizations running affected versions of GitLab must upgrade to version 19.2.8 or later for the 18.7 branch, 19.3.5 or later for the 19.3 branch, and 19.4.2 or later for the 19.4 branch immediately upon availability in their respective update channels. Until an upgrade is performed, administrators should review CI/CD configurations to ensure that sensitive variables are not exposed to pipelines triggered by lower-privilege users where possible, although this is a compensating control rather than a fix. It is also advisable to audit recent pipeline executions on protected branches for any anomalies or unauthorized activities during the window of exposure. Maintaining strict adherence to role-based access controls and regularly updating platform software are essential practices to prevent exploitation of such authorization bypass vulnerabilities in modern DevOps workflows.